diff --git a/libs/common/src/services/audit.service.spec.ts b/libs/common/src/services/audit.service.spec.ts
index b0e96eb5c5c..e43d54c3fe8 100644
--- a/libs/common/src/services/audit.service.spec.ts
+++ b/libs/common/src/services/audit.service.spec.ts
@@ -84,3 +84,65 @@ describe("AuditService", () => {
     await expect(auditService.breachedAccounts("user@example.com")).rejects.toThrow();
   });
 });
+
+describe("AuditService phishing domains", () => {
+  let auditService: AuditService;
+  let mockApi: jest.Mocked<ApiService>;
+
+  beforeEach(() => {
+    mockApi = {
+      nativeFetch: jest.fn(),
+    } as unknown as jest.Mocked<ApiService>;
+
+    auditService = new AuditService(
+      {} as any, // cryptoFunctionService not needed for these tests
+      mockApi,
+      {} as any, // hibpApiService not needed for these tests
+    );
+  });
+
+  it("should fetch and return phishing domains as array", async () => {
+    mockApi.nativeFetch.mockResolvedValueOnce({
+      text: jest.fn().mockResolvedValue("domain1.com\ndomain2.com\ndomain3.com"),
+    } as any);
+
+    const result = await auditService.getKnownPhishingDomains("https://example.com/domains.txt");
+    expect(result).toEqual(["domain1.com", "domain2.com", "domain3.com"]);
+  });
+
+  it("should return null if checksum has not changed", async () => {
+    mockApi.nativeFetch
+      .mockResolvedValueOnce({ text: jest.fn().mockResolvedValue("abc123") } as any)
+      .mockResolvedValueOnce({
+        text: jest.fn().mockResolvedValue("domain1.com\ndomain2.com"),
+      } as any);
+
+    const prevChecksum = "abc123";
+    const result = await auditService.getKnownPhishingDomainsIfChanged(
+      prevChecksum,
+      "https://example.com/checksum.txt",
+      "https://example.com/domains.txt",
+    );
+    expect(result).toBeNull();
+  });
+
+  it("should fetch and return domains and checksum if checksum changed", async () => {
+    mockApi.nativeFetch
+      .mockResolvedValueOnce({ text: jest.fn().mockResolvedValue("newchecksum") } as any)
+      .mockResolvedValueOnce({
+        text: jest.fn().mockResolvedValue("domain1.com\ndomain2.com"),
+      } as any);
+
+    const prevChecksum = "oldchecksum";
+    const result = await auditService.getKnownPhishingDomainsIfChanged(
+      prevChecksum,
+      "https://example.com/checksum.txt",
+      "https://example.com/domains.txt",
+    );
+    expect(result).toEqual({
+      domains: ["domain1.com", "domain2.com"],
+      checksum: "newchecksum",
+    });
+    expect(mockApi.nativeFetch).toHaveBeenCalledTimes(2);
+  });
+});